@synopackageland/cli 0.3.9 → 0.4.0

package/dist/templates/native-go/backend/internal/api/server.go

@@ -0,0 +1,155 @@
+package api
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"io"
+	"log"
+	"mime"
+	"net/http"
+	"net/url"
+)
+
+// MaxRequestBytes bounds the request body the CGI reads (CONTENT_LENGTH is
+// caller-controlled).
+const MaxRequestBytes = 1 << 20
+
+// ErrNoSession means the request carries no valid DSM session.
+var ErrNoSession = errors.New("no valid DSM session")
+
+// Authenticator verifies the DSM session behind a request.
+type Authenticator interface {
+	Authenticate(r *http.Request) (Identity, error)
+}
+
+// Server is the http.Handler behind the package CGI.
+type Server struct {
+	auth   Authenticator
+	routes map[string]Route
+}
+
+// NewServer refuses an empty authenticator and any route that is not usable,
+// so a mistake fails at startup instead of opening a route.
+func NewServer(auth Authenticator, routes ...Route) (*Server, error) {
+	if auth == nil {
+		return nil, errors.New("api.NewServer needs an Authenticator")
+	}
+	registry, err := buildRegistry(routes)
+	if err != nil {
+		return nil, err
+	}
+	return &Server{auth: auth, routes: registry}, nil
+}
+
+type request struct {
+	Method string          `json:"method"`
+	Params json.RawMessage `json:"params"`
+}
+
+func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	// DSM's CGI gateway cuts the reply short if the CGI exits with request
+	// bytes unread, so drain whatever the handling below did not consume.
+	defer io.Copy(io.Discard, r.Body)
+	defer func() {
+		if p := recover(); p != nil {
+			log.Printf("handler panic: %v", p)
+			writeError(w, internalError)
+		}
+	}()
+	req, apiErr := readRequest(w, r)
+	if apiErr != nil {
+		writeError(w, apiErr)
+		return
+	}
+	caller, route, apiErr := s.authorize(r, req.Method)
+	if apiErr != nil {
+		writeError(w, apiErr)
+		return
+	}
+	data, err := route.handler(r.Context(), caller, req.Params)
+	if err != nil {
+		writeError(w, asError(err))
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"success": true, "data": data})
+}
+
+// authorize is the single access decision. Public routes skip authentication;
+// everything else, including unknown methods, authenticates exactly once
+// first, so anonymous callers cannot probe which methods exist.
+func (s *Server) authorize(r *http.Request, method string) (Caller, Route, *Error) {
+	route, known := s.routes[method]
+	if known && route.policy == policyPublic {
+		return Caller{}, route, nil
+	}
+	identity, err := s.auth.Authenticate(r)
+	if errors.Is(err, ErrNoSession) {
+		return Caller{}, Route{}, &Error{"session_required", "sign in to DSM again"}
+	}
+	if err != nil {
+		log.Printf("authentication unavailable: %v", err)
+		return Caller{}, Route{}, &Error{"auth_unavailable", "DSM authentication is unavailable"}
+	}
+	if !known {
+		return Caller{}, Route{}, &Error{"unknown_method", "unknown method"}
+	}
+	caller := Caller{identity: identity, authenticated: true}
+	if route.policy == policyAdmin && !caller.Admin() {
+		return Caller{}, Route{}, &Error{"admin_required", "this action needs a DSM administrator"}
+	}
+	return caller, route, nil
+}
+
+func readRequest(w http.ResponseWriter, r *http.Request) (request, *Error) {
+	var req request
+	if r.Method != http.MethodPost {
+		return req, &Error{"method_not_allowed", "use POST"}
+	}
+	if mediaType, _, err := mime.ParseMediaType(r.Header.Get("Content-Type")); err != nil || mediaType != "application/json" {
+		return req, &Error{"json_required", "send Content-Type: application/json"}
+	}
+	if !sameOrigin(r) {
+		return req, &Error{"cross_origin", "cross-origin request refused"}
+	}
+	body, err := io.ReadAll(http.MaxBytesReader(w, r.Body, MaxRequestBytes))
+	if err != nil {
+		return req, &Error{"request_too_large", "request body too large"}
+	}
+	dec := json.NewDecoder(bytes.NewReader(body))
+	dec.DisallowUnknownFields()
+	if err := dec.Decode(&req); err != nil || dec.More() || req.Method == "" {
+		return req, BadRequest(`body must be {"method": "...", "params": {...}}`)
+	}
+	return req, nil
+}
+
+// sameOrigin refuses browser requests another site initiated. The JSON
+// content type already forces a CORS preflight, which DSM never answers; these
+// checks add an explicit refusal when the browser reports the origin.
+func sameOrigin(r *http.Request) bool {
+	if site := r.Header.Get("Sec-Fetch-Site"); site != "" && site != "same-origin" {
+		return false
+	}
+	if origin := r.Header.Get("Origin"); origin != "" {
+		u, err := url.Parse(origin)
+		return err == nil && u.Host == r.Host
+	}
+	return true
+}
+
+func writeJSON(w http.ResponseWriter, status int, body any) {
+	h := w.Header()
+	h.Set("Content-Type", "application/json")
+	h.Set("Cache-Control", "no-store")
+	h.Set("X-Content-Type-Options", "nosniff")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(body)
+}
+
+func writeError(w http.ResponseWriter, e *Error) {
+	writeJSON(w, http.StatusOK, map[string]any{
+		"success": false,
+		"error":   map[string]string{"code": e.Code, "message": e.Message},
+	})
+}

package/dist/templates/native-go/backend/internal/app/root_none.go

@@ -0,0 +1,9 @@
+package app
+
+import "dsmapp/internal/api"
+
+// rootRoutes is empty: this package declares privilege: none and never runs
+// anything as root. `synopkgland init -t native-go --privilege root` creates
+// root.go instead, which reads the results of administrator-approved root
+// operations.
+func (Config) rootRoutes() []api.Route { return nil }

package/dist/templates/native-go/backend/internal/app/routes.go

@@ -0,0 +1,127 @@
+// Package app holds this package's business operations. Add a route here and
+// pick its policy: api.User (any signed-in DSM user), api.Admin (DSM
+// administrators only) or, rarely, api.Public (no sign-in at all).
+package app
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"runtime"
+	"time"
+	"unicode/utf8"
+
+	"dsmapp/internal/api"
+	"dsmapp/internal/helper"
+)
+
+// Config is fixed at build time and startup, never taken from a request.
+type Config struct {
+	PackageID       string
+	Version         string
+	HelperInventory helper.Inventory
+	// DataDir is the package's persistent, package-owned directory
+	// (/var/packages/<package>/var). It survives upgrades.
+	DataDir string
+}
+
+func Routes(cfg Config) []api.Route {
+	routes := []api.Route{
+		api.User("integration.status", cfg.integrationStatus),
+		api.User("app.status", cfg.status),
+		api.User("greeting.get", cfg.getGreeting),
+		api.Admin("greeting.set", cfg.setGreeting),
+	}
+	return append(routes, cfg.rootRoutes()...)
+}
+
+func (cfg Config) integrationStatus(ctx context.Context, _ api.Caller, params json.RawMessage) (any, error) {
+	if err := decodeParams(params, &struct{}{}); err != nil {
+		return nil, err
+	}
+	return helper.NewClient(cfg.HelperInventory).Status(ctx), nil
+}
+
+func (cfg Config) status(_ context.Context, caller api.Caller, _ json.RawMessage) (any, error) {
+	return map[string]any{
+		"package":    cfg.PackageID,
+		"version":    cfg.Version,
+		"user":       caller.User(),
+		"admin":      caller.Admin(),
+		"process":    map[string]int{"uid": os.Getuid(), "gid": os.Getgid()},
+		"go_version": runtime.Version(),
+		"platform":   runtime.GOOS + "/" + runtime.GOARCH,
+		"time":       time.Now().UTC().Format(time.RFC3339),
+	}, nil
+}
+
+type greeting struct {
+	Text      string `json:"text"`
+	UpdatedBy string `json:"updated_by,omitempty"`
+}
+
+func (cfg Config) greetingPath() string { return filepath.Join(cfg.DataDir, "greeting.json") }
+
+func (cfg Config) getGreeting(context.Context, api.Caller, json.RawMessage) (any, error) {
+	data, err := os.ReadFile(cfg.greetingPath())
+	if errors.Is(err, fs.ErrNotExist) {
+		return greeting{Text: "Hello"}, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	var g greeting
+	return g, json.Unmarshal(data, &g)
+}
+
+func (cfg Config) setGreeting(_ context.Context, caller api.Caller, params json.RawMessage) (any, error) {
+	var in struct {
+		Text string `json:"text"`
+	}
+	if err := decodeParams(params, &in); err != nil {
+		return nil, err
+	}
+	if n := utf8.RuneCountInString(in.Text); n < 1 || n > 200 {
+		return nil, api.BadRequest("text must be 1 to 200 characters")
+	}
+	g := greeting{Text: in.Text, UpdatedBy: caller.User()}
+	data, err := json.Marshal(g)
+	if err != nil {
+		return nil, err
+	}
+	return g, writeFileAtomic(cfg.greetingPath(), data)
+}
+
+// decodeParams decodes params strictly: unknown fields are an error.
+func decodeParams(params json.RawMessage, into any) error {
+	if len(params) == 0 {
+		params = json.RawMessage(`{}`)
+	}
+	dec := json.NewDecoder(bytes.NewReader(params))
+	dec.DisallowUnknownFields()
+	if err := dec.Decode(into); err != nil {
+		return api.BadRequest("invalid params: " + err.Error())
+	}
+	return nil
+}
+
+// writeFileAtomic replaces path in one rename, so readers never see half a file.
+func writeFileAtomic(path string, data []byte) error {
+	tmp, err := os.CreateTemp(filepath.Dir(path), ".tmp-*")
+	if err != nil {
+		return err
+	}
+	defer os.Remove(tmp.Name())
+	if _, err := tmp.Write(data); err != nil {
+		tmp.Close()
+		return err
+	}
+	if err := tmp.Close(); err != nil {
+		return err
+	}
+	return os.Rename(tmp.Name(), path)
+}

package/dist/templates/native-go/backend/internal/app/routes_test.go

@@ -0,0 +1,167 @@
+package app
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"strings"
+	"testing"
+
+	"dsmapp/internal/api"
+)
+
+type stubAuth struct {
+	identity api.Identity
+	err      error
+}
+
+func (s stubAuth) Authenticate(*http.Request) (api.Identity, error) { return s.identity, s.err }
+
+func testConfig(t *testing.T) Config {
+	return Config{PackageID: "HelloGo", Version: "0.1.0-0001", DataDir: t.TempDir()}
+}
+
+// call returns the envelope's error code ("" on success) and the envelope.
+func call(t *testing.T, cfg Config, auth api.Authenticator, method, params string) (string, map[string]any) {
+	t.Helper()
+	srv, err := api.NewServer(auth, Routes(cfg)...)
+	if err != nil {
+		t.Fatal(err)
+	}
+	body := `{"method":"` + method + `","params":` + params + `}`
+	req := httptest.NewRequest(http.MethodPost, "/api.cgi", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	srv.ServeHTTP(rec, req)
+	var out map[string]any
+	if err := json.Unmarshal(rec.Body.Bytes(), &out); err != nil {
+		t.Fatalf("not JSON: %s", rec.Body.String())
+	}
+	if rec.Code != http.StatusOK {
+		t.Fatalf("HTTP %d: DSM replaces non-200 CGI bodies", rec.Code)
+	}
+	code := ""
+	if e, ok := out["error"].(map[string]any); ok {
+		code, _ = e["code"].(string)
+	}
+	return code, out
+}
+
+var (
+	alice  = stubAuth{identity: api.Identity{User: "alice", Admin: true}}
+	bob    = stubAuth{identity: api.Identity{User: "bob"}}
+	nobody = stubAuth{err: api.ErrNoSession}
+)
+
+// sampleParams holds valid params for every route, so the denial test below
+// proves the refusal came from the policy and not from bad input.
+var sampleParams = map[string]string{
+	"integration.status": `{}`,
+	"app.status":         `{}`,
+	"greeting.get":       `{}`,
+	"greeting.set":       `{"text":"Hi"}`,
+}
+
+func TestIntegrationStatusIsReadableByOrdinaryUsers(t *testing.T) {
+	code, out := call(t, testConfig(t), bob, "integration.status", `{}`)
+	if code != "" || out["data"].(map[string]any)["state"] != "not-enabled" {
+		t.Fatalf("%s: %v", code, out)
+	}
+	code, _ = call(t, testConfig(t), bob, "integration.status", `{"state":"ready"}`)
+	if code != "bad_request" {
+		t.Fatal("browser cannot supply readiness")
+	}
+}
+
+func TestEveryRouteHasSampleParamsAndNoneIsPublic(t *testing.T) {
+	routes := Routes(testConfig(t))
+	if len(routes) != len(sampleParams) {
+		t.Fatalf("%d routes but %d sample params: add the new route to sampleParams", len(routes), len(sampleParams))
+	}
+	for _, r := range routes {
+		if _, ok := sampleParams[r.Method()]; !ok {
+			t.Errorf("route %s has no sample params", r.Method())
+		}
+		if r.Public() {
+			t.Errorf("route %s is public; this template ships none", r.Method())
+		}
+	}
+}
+
+func TestEveryRouteRefusesCallersWithoutASessionAndChangesNothing(t *testing.T) {
+	for _, r := range Routes(testConfig(t)) {
+		cfg := testConfig(t)
+		code, _ := call(t, cfg, nobody, r.Method(), sampleParams[r.Method()])
+		if code != "session_required" {
+			t.Errorf("%s: %q, want session_required", r.Method(), code)
+		}
+		assertDataDirEmpty(t, cfg)
+	}
+}
+
+func TestEveryAdminRouteRefusesOrdinaryUsersAndChangesNothing(t *testing.T) {
+	for _, r := range Routes(testConfig(t)) {
+		if !r.AdminOnly() {
+			continue
+		}
+		cfg := testConfig(t)
+		code, _ := call(t, cfg, bob, r.Method(), sampleParams[r.Method()])
+		if code != "admin_required" {
+			t.Errorf("%s: %q, want admin_required", r.Method(), code)
+		}
+		assertDataDirEmpty(t, cfg)
+	}
+}
+
+func TestEveryRouteSucceedsForAnAdmin(t *testing.T) {
+	for _, r := range Routes(testConfig(t)) {
+		code, out := call(t, testConfig(t), alice, r.Method(), sampleParams[r.Method()])
+		if code != "" {
+			t.Errorf("%s: %q %v", r.Method(), code, out)
+		}
+	}
+}
+
+func TestStatusReportsPackageAndCaller(t *testing.T) {
+	code, out := call(t, testConfig(t), bob, "app.status", `{}`)
+	data := out["data"].(map[string]any)
+	if code != "" || data["package"] != "HelloGo" || data["version"] != "0.1.0-0001" || data["user"] != "bob" || data["admin"] != false {
+		t.Fatalf("got %q %v", code, out)
+	}
+}
+
+func TestGreetingDefaultsAndAdminCanChangeIt(t *testing.T) {
+	cfg := testConfig(t)
+	_, out := call(t, cfg, bob, "greeting.get", `{}`)
+	if got := out["data"].(map[string]any)["text"]; got != "Hello" {
+		t.Fatalf("default greeting = %v", got)
+	}
+	if code, out := call(t, cfg, alice, "greeting.set", `{"text":"Hi from DSM"}`); code != "" {
+		t.Fatalf("set: %q %v", code, out)
+	}
+	_, out = call(t, cfg, bob, "greeting.get", `{}`)
+	data := out["data"].(map[string]any)
+	if data["text"] != "Hi from DSM" || data["updated_by"] != "alice" {
+		t.Fatalf("after set: %v", data)
+	}
+}
+
+func TestGreetingSetValidatesText(t *testing.T) {
+	for _, params := range []string{`{}`, `{"text":""}`, `{"text":"` + strings.Repeat("x", 201) + `"}`, `{"text":7}`, `{"text":"ok","extra":1}`} {
+		cfg := testConfig(t)
+		code, _ := call(t, cfg, alice, "greeting.set", params)
+		if code != "bad_request" {
+			t.Errorf("%s: %q, want bad_request", params, code)
+		}
+		assertDataDirEmpty(t, cfg)
+	}
+}
+
+func assertDataDirEmpty(t *testing.T, cfg Config) {
+	t.Helper()
+	entries, err := os.ReadDir(cfg.DataDir)
+	if err != nil || len(entries) != 0 {
+		t.Fatalf("data dir changed: %v %v", entries, err)
+	}
+}

package/dist/templates/native-go/backend/internal/dsm/auth.go

@@ -0,0 +1,118 @@
+// Package dsm verifies the DSM login behind a package CGI request.
+//
+// DSM runs a package's CGI as the package account and forwards the browser's
+// cookies. This package hands only the session carriers (cookie, SynoToken,
+// client address) to DSM's own authenticate.cgi, which prints the signed-in
+// user name, then reads administrators membership from DSM's group file. It
+// never parses the session cookie or trusts a user name from the request.
+package dsm
+
+import (
+	"bufio"
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"os/exec"
+	"regexp"
+	"slices"
+	"strings"
+	"time"
+
+	"dsmapp/internal/api"
+)
+
+// AuthenticateCGI is DSM's session check for third-party CGIs.
+const AuthenticateCGI = "/usr/syno/synoman/webman/modules/authenticate.cgi"
+
+// Authenticator implements api.Authenticator against DSM.
+type Authenticator struct {
+	GroupFile  string
+	AdminGroup string
+	Timeout    time.Duration
+	run        func(ctx context.Context, path string, env []string) ([]byte, error)
+}
+
+func NewAuthenticator() *Authenticator {
+	return &Authenticator{
+		GroupFile:  "/etc/group",
+		AdminGroup: "administrators",
+		Timeout:    10 * time.Second,
+		run:        runCGI,
+	}
+}
+
+var userName = regexp.MustCompile(`^[A-Za-z0-9._@\\-]{1,64}$`)
+
+func (a *Authenticator) Authenticate(r *http.Request) (api.Identity, error) {
+	cookie := r.Header.Get("Cookie")
+	if cookie == "" {
+		return api.Identity{}, api.ErrNoSession
+	}
+	ctx, cancel := context.WithTimeout(r.Context(), a.Timeout)
+	defer cancel()
+	out, err := a.run(ctx, AuthenticateCGI, sessionEnv(r, cookie))
+	var exit interface{ ExitCode() int }
+	if errors.As(err, &exit) {
+		return api.Identity{}, api.ErrNoSession
+	}
+	if err != nil {
+		return api.Identity{}, fmt.Errorf("run %s: %w", AuthenticateCGI, err)
+	}
+	user := strings.TrimSpace(string(out))
+	if !userName.MatchString(user) {
+		return api.Identity{}, api.ErrNoSession
+	}
+	admin, err := a.isMember(user)
+	if err != nil {
+		return api.Identity{}, err
+	}
+	return api.Identity{User: user, Admin: admin}, nil
+}
+
+// sessionEnv is the complete environment authenticate.cgi sees: nothing from
+// this process and no request header besides the session carriers.
+func sessionEnv(r *http.Request, cookie string) []string {
+	token := r.Header.Get("X-SYNO-TOKEN")
+	host, _, err := net.SplitHostPort(r.RemoteAddr)
+	if err != nil {
+		host = r.RemoteAddr
+	}
+	return []string{
+		"REQUEST_METHOD=GET",
+		"HTTP_COOKIE=" + cookie,
+		"HTTP_X_SYNO_TOKEN=" + token,
+		"QUERY_STRING=SynoToken=" + url.QueryEscape(token),
+		"REMOTE_ADDR=" + host,
+	}
+}
+
+func runCGI(ctx context.Context, path string, env []string) ([]byte, error) {
+	cmd := exec.CommandContext(ctx, path)
+	cmd.Env = env
+	return cmd.Output()
+}
+
+// isMember reads the group file fresh on every request, so removing someone
+// from administrators takes effect immediately.
+func (a *Authenticator) isMember(user string) (bool, error) {
+	f, err := os.Open(a.GroupFile)
+	if err != nil {
+		return false, fmt.Errorf("read groups: %w", err)
+	}
+	defer f.Close()
+	scanner := bufio.NewScanner(f)
+	for scanner.Scan() {
+		fields := strings.Split(scanner.Text(), ":")
+		if len(fields) == 4 && fields[0] == a.AdminGroup {
+			return slices.Contains(strings.Split(fields[3], ","), user), nil
+		}
+	}
+	if err := scanner.Err(); err != nil {
+		return false, fmt.Errorf("read groups: %w", err)
+	}
+	return false, nil
+}